CVE-2025-4814 is a high severity SQL injection (CVSS 7.3) in Campcodes Sales and Inventory System 1.0. The Name argument of /pages/supplier_add.php is not handled safely, and the CVE record says the attack can be launched remotely. The record lists no fixed version, so check with the vendor and correct the query in your copy.
What's affected
The CVE record names one affected release: Campcodes Sales and Inventory System 1.0. The weakness is in /pages/supplier_add.php, where the Name argument reach a database query. The record classifies it under CWE-74 (Injection), CWE-89 (SQL Injection).
No patched version appears in the record, and the references are an issue report, the vendor home page and VulDB entries rather than a release note. If a fixed release exists, it will be on the vendor or author site, so check there before you rely on any version number.
Severity comes from the base vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L. That reads as network reachable, low complexity, no privileges and no user interaction, with limited impact on confidentiality, integrity and availability.
How to check if you're exposed
This is a self-hosted PHP application, not a package from a registry, so there is no version to look up with a package manager. Work from your own deployment instead.
First, find out whether you run it at all. Search your web roots for the vulnerable file:
find /var/www -type f -name "supplier_add.php" 2>/dev/null
Then read how the file builds its query. If the code joins Name into a SQL string instead of passing it as a bound parameter, it is exposed:
grep -n "Name" /path/to/pages/supplier_add.php
Next, check who can reach it. Look at your web server access logs for requests to /pages/supplier_add.php from addresses you do not recognise. Unusual quote characters or SQL keywords in the Name values are worth a closer look. Do not test the flaw against a system you do not own.
Last, check the database account the app uses. If it can read every table or write outside its own schema, a query flaw does more damage than it needs to.
What to do now
- Take the application off the public internet, or restrict it to a VPN or an allow list, until the query is fixed.
- Check the vendor or author site for an updated release and read its notes. Do not assume a new download fixes CVE-2025-4814 unless the notes say so.
- Change the code that uses
Namein/pages/supplier_add.phpto a prepared statement with bound parameters. Do not build the query by joining strings. - Review the other pages in the same application. One unsafe query pattern is often repeated across several files in a small application.
- Give the application database user only the rights it needs, and keep it away from other schemas.
- Review database and web logs for the period since the application went online, and rotate credentials if you see signs of misuse.
- If you cannot patch, put a web application firewall rule in front of the endpoint as a stopgap, and plan a proper code fix.
Why it matters
SQL injection happens when input from a request becomes part of a database command, so the database cannot tell the developer's intent from the visitor's text. The class is CWE-89 (SQL Injection), a child of CWE-74 (Injection). The fix has been known for decades: separate code from data with parameterized queries.
The CVE record notes that a working exploit has been disclosed to the public. It does not say the flaw is exploited in the wild, and it is not on the CISA Known Exploited Vulnerabilities list. Small self-hosted PHP projects are often deployed as they were downloaded, with no vendor security team behind them and no regular update channel. A finding like this deserves a look even when the vendor is tiny, because the exposure sits in your deployment, not in a package manager you can update with one command.
A score of 7.3 is high rather than critical because the vector shows limited impact on each of confidentiality, integrity and availability. Limited still means an outsider reading or changing records in a live database, and in a system that holds personal or business data that is serious enough to act on.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Is CVE-2025-4814 fixed?
The CVE record lists no fixed version. Check the vendor or author site for a newer release and read its notes. If none exists, fix the query in your own copy with prepared statements or retire the application.
Is CVE-2025-4814 being exploited in the wild?
The record says a working exploit has been disclosed to the public, which is not the same as confirmed attacks. It is not on the CISA Known Exploited Vulnerabilities list. Treat it as likely to be tried against any exposed instance.
Sources
- NVD record for CVE-2025-4814
- github.com reference
- vuldb.com reference
- vuldb.com reference
- vuldb.com reference
- www.campcodes.com reference
Last reviewed: 18 October 2026.
